Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
In the USA. They range from 4 (St. Helena) to 13 (Austria), I believe.
An incident impacting 5M accounts and private information on Twitter
141–150 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#142Earlier quoted context omitted.
"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.
"an absence of evidence is not evidence of absence" Isn't that taught in..uh..I dunno, middle school science class? Just because you don't see the rabbit, doesn't mean it doesn't exist.
No, that's insane. That means I can just tell people you might have raped someone, I don't have any evidence but that doesn't mean it didn't happen.
https://medicine.uq.edu.au/article/2019/04/you-look-do-not-f...
Re: An incident impacting 5M accounts and private information on Twitter
#143> How to Protect Your Account
> (...) To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account.
Well, you're the ones constantly temporarily banning my account for not providing a phone number...
Re: An incident impacting 5M accounts and private information on Twitter
#144Earlier quoted context omitted.
It's typically smaller though, not every phone number is allocated and many are in sequential groups. Some are special cased, you don't need to search any number matching `****555***` in north america for example, which cuts down on the search space quite a bit.
"Quite a bit"? Filtering out ***555**** removes only 0.1% of phone numbers ;)
That's one example of an invalid range, not all of them. Lots of the area codes in north america just haven't been used for one reason or another.
Re: An incident impacting 5M accounts and private information on Twitter
#145Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account.
Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total accounts (~290M). I don't know what the industry average is for linking phone numbers, but this seems like an exceptionally low ratio.
Re: An incident impacting 5M accounts and private information on Twitter
#146I believe this is the vulnerability reported to Twitter which awarded $5000 from its bug bounty program. https://hackerone.com/reports/1439026
$5k seems embarrassingly low so something with such horrendous impact. Potentially allowing for doxing, and because phone numbers are the lynchpin for many 2FA and consumer-facing telco security is generally lax, total user hijacking across multiple platforms. What an absolute disaster.
if the disclosure and fix time is half a year, a blackhat is now able to both claim the bug bounty and sell the day zero exploit
Re: An incident impacting 5M accounts and private information on Twitter
#147Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service)
With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.
Re: An incident impacting 5M accounts and private information on Twitter
#148>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
> I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter. I had some old accounts that did not require a phone number. At least until I wanted to enable TOTP 2FA. At which point the numnuts at Twitter would not just let me "just" enable TOTP, I was forced to provide a phone number (which, to add insult to injury, for at long time they refused to accept because they would only s…
Twitter decides when to hit you with the demand for a phone number. Try sh!itposting for a couple weeks. That usually does the trick.
This may be Twitter's best anti-bot measure, although state-sponsored troll farms will likely be able to afford all the SIM cards they want and need.
Re: An incident impacting 5M accounts and private information on Twitter
#149Earlier quoted context omitted.
No mention of that fact that 'use another phone number' is quite an expensive thing to do in countries where a phone number has an annual fee of hundreds of dollars. Suddenly 'use twitter securely' has gone from 'free' to 'hundreds of dollars a year'. Perhaps they should announce this as a price change instead?
If you know the right providers it's about $2/month for a non-VOIP, physical SIM to receive SMS for this sort of garbage.
Anyone accept Monero?
Re: An incident impacting 5M accounts and private information on Twitter
#150Earlier quoted context omitted.
AFAIK there is an exception for security purposes. They could be hashing or "anonymizing" the IPs and keep the data longer.
No that's not valid at all! You must remove any trace of your ability to backwards engineering the IPs. Hashing isn't sufficient since it's so easy to run over the whole IPv4 space. This is one of the trade offs.
You can if the hash collides within the IPv4 address space; ie it's a hash of less than about 16 bits. Enough to let your roughly see if something fishy is going on but you can't reverse engineer to any specific IP, only a set of 64 thousand.